Versions Compared

Old Version 6

changes.mady.by.user Former user

Saved on

compared with

New Version Current

changes.mady.by.user Former user

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

An API creator blocks subscription to an API as a way of disabling access to it and managing its usage and monetization. A blocking can be temporary or permanent. You block APIs by . You get an unblock option to allow API invocations again.

Panel
bgColor#d3d3d3

In this tutorial, you block subscription to an API in the API Publisher and observe how the subscribers can interact with it in the API Store. You also observe how the subscriber experience changes when you unblock the API again.

Note

You block APIs by subscriptions. That is,

...

a given user is blocked access to a given API subscribed to using a given application. If a user is subscribed to two APIs using the same application

...

and you

...

block access to only one of the APIs

...

, s/he can still continue to invoke the other APIs that s/he subscribed to using the same application

...

. Also, s/he can continue to access the same API subscribed to using different applications.

...

Blocking happens in two levels:

  • Block production and sandbox access: API access is blocked with both production and sandbox keys.
  • Block production access only: Allows sandbox access only. Useful when you

...

  • want to fix and test an issue in an API. Rather than blocking all access, you can block production access only, allowing the developer to fix and test.

When the API Gateway caching

...

 is enabled (it is enabled by default), even after blocking a subscription, consumers might still be able to access APIs until the cache expires, which happens approximately every

...

15 minutes.

  1. Log in to the API Publisher.
  2. Create two APIs by the names TestAPI1 and TestAPI2 and publish them to the API Store.
    Image Added
  3. Log in to the API Store. Click the APIs menu and note

...

See the following topics for a description of the concepts that you need to know when you block subscriptions to an API:

...

  1. that the two APIs are visible in the APIs page.
    Image Added
  2. Subscribe to both APIs using the same application. You can use an existing application or create a new one. 
    Image Added
  3. Click the APPLICATIONS menu, click the application that you used to subscribe to the API with (DefaultApplication in this example), go to its Production Keys tab, and re-generate its access token. By default, access tokens expire an hour after creation application.
    Image Added

  4. Invoke both APIs using the access token you got in the previous step. We use cURL here. The command is,

    Code Block
    curl -k -H "Authorization: Bearer <access token>" '<API URL>'

    Be sure to replace the placeholders as follows:

    • <access token>: Give the token generated in step 5

    • <API URL>: Go to the API's Overview tab in the API Store and copy the production URL and append the payload to it. 

    Here's an example:

    Code Block
    curl -k -H "Authorization: Bearer f1d4d097-ebcc-3f02-8d91-0bd4e882ffcd" 'https://gateway.api.cloud.wso2.com:443/t/companyn3/test1/1.0.0/CheckPhoneNumber?PhoneNumber=18006785432&LicenseKey=0'

    Image Added
    You have subscribed to two APIs and invoked them successfully. Let's block one subscription and see the outcome.

  5. Block an API.
    1. Sign back into the API Publisher.
    2. Click on the API that you need to block.
      In this case, click on the TestAPI1 API.
    3. Click Subscriptions to navigate to the managed subscription section.
      Image Added
    4. Click Block.
       Note that the Block link immediately turns to Unblock, allowing you to activate the subscription back at any time.

  6. Invoke the APIs to test the blocked API.

    1. Sign back in to the API Store.
    2. Invoke the two APIs (TestAPI1 and TestAPI2) again. 

  7. Invoke the two APIs (TestAPI1 and TestAPI2) again.

    Note

    You might have to regenerate the access token for DefaultApplication as done in step5, if the access token expiration time (1 hour by default) has passed since the last time you generated it.

  8. Note that you can invoke TestAPI2 again but when you invoke TestAPI1, it gives a message that the requested API is temporarily blocked. Neither the API creator nor any subscriber can invoke the API until the block is removed.
    Image Added

    Tip

    Tip: You might still be able to invoke an API within 15 minutes after blocking a subscription, until the cache is renewed.

  9. Back in the API Store, click the APPLICATIONS menu, select the application that you used to subscribe to the two APIs earlier, click its Subscriptions tab, and note that your subscription is now blocked.
    Image Added
  10. Unblock the API.
    1. Go back to the API Publisher.
    2. Click on the respective API
      In this case click TestAPI1 1.0.0.
    3. Click Subscriptions and click Unblock corresponding to the respective subscription.
      Make sure to click on the subscription that corresponds to the correct Application. 

    If you invoke TestAPI1 again, you will notice that you can invoke the API as usual.

    Tip

    Tip: You might still be unable to invoke an API within 15 minutes after unblocking a subscription, until the cache is renewed.

    You have subscribed to two APIs, blocked subscription to one and tested that you cannot invoke the blocked API.